This month’s patch cycle from Microsoft addresses a range of vulnerabilities, none of which are reported as zero-days, with a total of 60 Windows patches released.
Among the notable vulnerabilities is CVE-2024-21334, a flaw in open management infrastructure (OMI) with a CVSS score of 9.8. This vulnerability affects System Center Operations Manager versions prior to 1.8.1-0, allowing an unauthenticated remote attacker to exploit a use-after-free bug in an OMI instance.
Another significant vulnerability is CVE-2024-21400, a privilege escalation issue rated at 9.0 on the CVSS scale. This bug impacts Microsoft’s Azure Kubernetes Service Confidential Container, potentially enabling an unauthenticated attacker to pilfer credentials and assume control over confidential guests and containers beyond the network stack it’s bound to.
CVE-2024-21407 is identified as a Hyper-V remote code execution vulnerability, carrying a CVSS score of 8.1.
Additionally, Microsoft has designated CVE-2024-21408 as a denial-of-service bug in Hyper-V, despite its lower CVSS score of 5.5. No further details are provided about this vulnerability.
The Patch Tuesday release also includes fixes for five Chromium bugs and one Android bug, which solely affect Microsoft Edge.
There are discrepancies in Microsoft’s descriptions of these vulnerabilities, as observed by the SANS Institute. For instance, Microsoft labels the two Hyper-V vulnerabilities, CVE-2024-21407 and CVE-2024-21408, as having “Max severity: Critical”, despite their CVSS scores falling below 9.0. Conversely, CVE-2024-21334 (CVSS score 9.8) and CVE-2024-21400 (CVSS score 9.0) are categorized as “Max severity: Important”, despite their higher scores.
Microsoft has been approached for clarification on these discrepancies.
